NAT question

[Amafsha1]

Hello, let's say I have used the NAT pool command to specify my starting to ending address used for translation of internal to external for publicy routable address.

Why is it that when I input the "show ip nat translations" command I see the Inside global address to be the address of my L3 interface I have used to connect to the ISP.  I thougth what was configured as my "pool" would be used as the inside global address which is the .238 I have configured below.  When I see videos online, I always see the pool address being shown in the translation table and not the interface address.  Can anyone explain why this is the case?

[Georg Pauwen]

Hello,

is this a partial config ? Do you have:

access-list 1 permit 172.2.3.0 0.0.0.127

!

ip nat inside source list 1 pool OFFICE_NAT overload

configured ? Either way, static NAT has precedence, so that would be what you see in your translation table...

[Amafsha1]

No overload is not configured on this router and there is no ACL like that.  THis router is misconfigured and   seems to be only serving IPSEc tunnels since there is never more than 30-40 entries for translation table and its always the address for IPSec tunnels we have here. sorry about the confusion, not well configured.  When you say static should be first, but where is the static NAT configuration for this?  I have listed everything thats in the configs.  All I see is the pool command for .238

[Georg Pauwen]

Hello,

these are your static entries:

ip nat inside source static esp 172.2.3.1 interface GigabitEthernet0/0/1
ip nat inside source static udp 172.2.3.1 500 interface GigabitEthernet0/0/1 500
ip nat inside source static 172.2.3.5 67.x.x.37 route-map ISP-nat

What do you want to accomplish...for the LAN clients to be able to access the Internet ?

[Amafsha1]

exactly.  We have another router that is configured almost the same that is the primary; just the nat configs are different, which is probably why when we make the BGP switchover to this Router, they can't access the internet properly.  

Ok, the reason why I asked about the static NAT is because I thought that the "inside global" should be listed in the static entries, the 63.x.x.234 which is not anywhere in the static entries, but is the only inside global ip for the translation table.  Then how does the IP of 172.31.255.x know that 63.x.x.234 is the one it's supposed to translate too?

[Georg Pauwen]

Hello,

ip address 63.x.x.234 255.255.255.248

is the IP address of the outside interface, so that is the only address currently 'known' to NAT...

[Amafsha1]

ok that makes sense, let's say I would want to change it so that the address is 63.x.x.239.  How would I make that possible?

I mean not changing the interface, but chaning the translation.

[Georg Pauwen]

Hello,

here is an example:

ip nat inside source static udp 172.2.3.1 500 63.x.x.239 500

[Amafsha1]

got it.  but wouldn't the NAT pool config "ip nat pool OFFICE_NAT 63.x.x.238 63.x.x.238 prefix-length 1" supposed to be the inside global address? We configured the pool, so we would expect that to be the IP to be used on the outside that represents us?

[Georg Pauwen · Accepted solution]

You configured the pool, but you didn't reference the inside source. This is what you need to add:

ip nat inside source list 1 pool OFFICE_NAT overload

But even with that pool, static NAT takes preference, so you would have to delete the static entries...

[Amafsha1]

Thanks very much!  I got 1 more question.  Below is the main router which is currently serving all the LAN clients(many more nat translations present).
I put a sample of what the NAT translation looks like at the bottom.  Everytime that I go into "look up my ip" on web browser it always says my ip is 13.x.x.8,
which is the pool that's configured back on the other router (Router 1) that is serving the IPsec tunnels.  But I would think that when I open up a web browser at work
it would say that my IP from the outside is 13.x.x.5 because that's the inside global address right here in the translation tables.  Am I misunderstanding again? 

[Georg Pauwen]

Hello,

I am not clear on how both routers interact. Can you post the full configs of both ?

[Amafsha1]

Ok I will attach it.  Good luck deciphering it, they are both configured with 2 different ISPs so that we can failover incase ISP1 fails.  Both routers can get to both ISPs (both routers have bgp neighborships to both ISPs).  The BGP failover works apparently, but somewhere along the way we can't access internet proerply because of NAT issues.  ISP2 is a smaller circuit, ISP1 is currently the primary.